Microweber Unauthenticated File Read (CVE-2026-65694)

Summary

CVE-2026-65694 is an unauthenticated path-traversal → arbitrary file read in Microweber CMS via the public GET /userfiles/{path} static-file controller. A ?path= query parameter can override the route segment through Laravel’s request property resolution, while normalize_path() fails to canonicalize or confine the result inside userfiles_path(). PHP then resolves ../ sequences on disk.

Affected: Microweber ≤ 2.0.20 (and vulnerable master lines at disclosure). Credit: Bobur Abdugafforov (VulnCheck CVE assignment). Public PoC indexed on Sploitus.

OFFSITE.DARK indexes the Sploitus card and researcher write-up only.

Technical Details

Two bugs combine:

1. $request->path property (not path()) can be overridden by ?path=.
2. No realpath jail — normalized path never verified to stay under userfiles_path().

Impact

Leak of Laravel .env (APP_KEY → session forgery, DB/mail/cloud secrets), host files the web user can read, and other non-PHP assets. Often escalates to full instance compromise.

Mitigation

1. Upgrade Microweber past the patched release once available; apply vendor fix that uses route-bound path + realpath() confinement.
2. Until patched: deny /userfiles/ query path= at WAF/reverse proxy; serve userfiles only via hardened static mapping.
3. Rotate APP_KEY, DB credentials, and API keys if the instance was exposed unpatched.
4. Prefer document-root layouts that never dispatch traversal-capable controllers for static trees.

Sources

• Sploitus — CVE-2026-65694
• Microweber GitHub